caddyserver/caddy · error

encoding root key: %v

Error message

encoding root key: %v

What it means

genRoot PEM-encodes the root private key with certmagic.PEMEncodePrivateKey before storing it. If the signer cannot be serialized to PEM (unsupported key type or nil signer from generation), the wrap 'encoding root key' aborts root creation before the key is saved. Like 589, this is an internal-invariant failure, not environmental.

Source

Thrown at modules/caddypki/ca.go:335

func (ca CA) genRoot() (rootCert *x509.Certificate, rootKey crypto.Signer, err error) {
	repl := ca.newReplacer()

	rootCert, rootKey, err = generateRoot(repl.ReplaceAll(ca.RootCommonName, ""))
	if err != nil {
		return nil, nil, fmt.Errorf("generating CA root: %v", err)
	}
	rootCertPEM, err := pemEncodeCert(rootCert.Raw)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding root certificate: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyRootCert(), rootCertPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving root certificate: %v", err)
	}
	rootKeyPEM, err := certmagic.PEMEncodePrivateKey(rootKey)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding root key: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyRootKey(), rootKeyPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving root key: %v", err)
	}

	return rootCert, rootKey, nil
}

func (ca CA) loadOrGenIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCertChain []*x509.Certificate, interKey crypto.Signer, err error) {
	var interCert *x509.Certificate
	interCertPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateCert())
	if err != nil {
		if !errors.Is(err, fs.ErrNotExist) {
			return nil, nil, fmt.Errorf("loading intermediate cert: %v", err)
		}

		// TODO: should we require that all or none of the assets are required before overwriting anything?

View on GitHub (pinned to 50e54ee279)

Solutions

1. Run an unmodified, current Caddy build.
2. If you inject a custom signer or fork the code, ensure it is a standard *ecdsa.PrivateKey or ed25519 key that certmagic can encode.
3. If reproducible on stock builds, capture the wrapped error and report upstream.

// internal invariant: capture wrapped error, retry once, report upstream if repeated
if strings.Contains(err.Error(), "encoding root key") { retryOrReport(err) }

When it happens

Trigger: PEMEncodePrivateKey(rootKey) errors: the generated signer is of a type the encoder cannot handle (custom/test signer injected, unusual algorithm) or generation returned a nil/invalid signer despite no error. Only on the new-root path.

Common situations: Rare in stock Caddy (ECDSA P-256 encodes fine). Appears with code that injects custom crypto.Signer implementations, source modifications, or corrupted library builds.

Related errors

• decoding root key: %v
• encoding root certificate: %v
• encoding intermediate certificate: %v
• loading signing key: %v
• parsing root certificate PEM: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/6e4b2a5377d54118. Report an issue: GitHub.